{"id":22787339,"url":"https://github.com/aserto-dev/flask-aserto","last_synced_at":"2026-02-18T14:04:06.007Z","repository":{"id":217679972,"uuid":"743948241","full_name":"aserto-dev/flask-aserto","owner":"aserto-dev","description":"Aserto Flask middleware","archived":false,"fork":false,"pushed_at":"2025-03-25T20:08:41.000Z","size":270,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-04-15T23:52:19.008Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aserto-dev.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-01-16T10:25:05.000Z","updated_at":"2025-03-25T20:08:44.000Z","dependencies_parsed_at":"2026-01-13T21:01:21.311Z","dependency_job_id":null,"html_url":"https://github.com/aserto-dev/flask-aserto","commit_stats":null,"previous_names":["aserto-dev/flask-aserto"],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/aserto-dev/flask-aserto","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aserto-dev%2Fflask-aserto","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aserto-dev%2Fflask-aserto/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aserto-dev%2Fflask-aserto/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aserto-dev%2Fflask-aserto/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aserto-dev","download_url":"https://codeload.github.com/aserto-dev/flask-aserto/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aserto-dev%2Fflask-aserto/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29581539,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-18T13:56:48.962Z","status":"ssl_error","status_checked_at":"2026-02-18T13:54:34.145Z","response_time":162,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-12T00:54:10.521Z","updated_at":"2026-02-18T14:04:05.991Z","avatar_url":"https://github.com/aserto-dev.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Aserto Flask middleware\nThis is the official library for integrating [Aserto](https://www.aserto.com/) authorization into your [Flask](https://github.com/pallets/flask) applications.\n\n## Aserto Middleware\nWhen authorization middleware is configured and attached to a server, it examines incoming requests, extracts authorization parameters like the caller's identity, calls the Aserto authorizers, and rejects messages if their access is denied.\n\n`AuthorizerOptions` are needed for the cration of an `AsertoMiddleware`.\n\n```py\noptions = AuthorizerOptions(\n        url=authorizer_service_url,\n        tenant_id=tenant_id,\n        api_key=authorizer_api_key,\n        cert_file_path=cert_file_path,\n    )\n```\n\nTo instatiate the middleware, after creating the authorizer's options:\n\n```py\nfrom flask_aserto import AsertoMiddleware, AuthorizationError\n\n\napp = Flask(__name__)\naserto = AsertoMiddleware(options)\n\n```\n\nBesides the authorizer's options, the following can be configure when creating the middleware:\n\n```py\n        authorizer_options: AuthorizerOptions,\n        policy_path_root: str,\n        identity_provider: IdentityMapper,\n        policy_instance_name: Optional[str]= None,\n        policy_instance_label: Optional[str]= None,\n        policy_path_resolver: Optional[StringMapper] = None,\n        resource_context_provider: Optional[ResourceMapper] = None,\n```\n\n### Policy\n`policy_path_root` is the name of the authorization policy package to evaluate.`policy_instance_name`, `policy_instance_label` are the name and label of the policy that is used by the authorizer.\n\nThe authorization policy's ID and the decision to be evaluated are specified when creating authorization Middleware, but the policy path is often derived from the URL or method being called. To provide custom logic, `policy_path_resolver` can be provided. An example can be found\nhttps://github.com/aserto-dev/flask-aserto/tree/HEAD/src/flask_aserto/_defaults.py\n\n### Identity\nMiddleware offer control over the identity used in authorization calls by providing an `IdentityMapper`. Example of a method that takes the identity from flask's `g` object:\n\n```py\ndef identity_provider() -\u003e Identity:\n    identity = g.identity\n\n    if identity is None:\n        return Identity(IdentityType.IDENTITY_TYPE_NONE)\n\n    return Identity(type=IdentityType.IDENTITY_TYPE_SUB, value=identity)\n```\n\n### Resource\nA resource can be any structured data that the authorization policy uses to evaluate decisions. By default, middleware do not include a resource in authorization calls.\n\nTo add resource data, you can provide a `ResourceMapper` to `resource_context_provider` to attach custom logic. For example:\n\n```py\ndef resource_context_from_request() -\u003e ResourceContext:\n    return request.view_args or {}\n```\n\n### Add authorization checks to your routes\nBelow, there is an example of how to add the Middleware to your routes:\n\n```py\nfrom flask_aserto import AsertoMiddleware, AuthorizationError\n\n\napp = Flask(__name__)\naserto = AsertoMiddleware(**aserto_options)\n\n\n@app.route(\"/api/users/\u003cid\u003e\", methods=[\"GET\"])\n@aserto\ndef api_user(id: str) -\u003e Response:\n    # Raises an AuthorizationError if the `GET.api.users.__id`\n    # policy returns a decision of \"allowed = false\"\n    ...\n```\n\n## Check Middleware (ReBAC)\nIn addition to the pattern described above, in which each route is authorized by its own policy module, the middleware can be used to implement Relation-Based Access Control (rebac) in which authorization decisions are made by checking if a given subject has the necessary permission or relation to the object being accessed.\n\nThis is achieved using the `Check` function on `AsertoMiddleware`.\n\nA check call needs three pieces of information:\n    - The type and key of the object.\n    - The name of the relation or permission to look for.\n    - The type and key of the subject. When omitted, the subject is derived from the middleware's Identity with type \"user\".\n\nExample:\n```py\n\ndef id_mapper() -\u003e str:\n    return request.view_args['asset']\n\n@app.route(\"/resource/\u003casset\u003e\", methods=[\"GET\"])\n@requires_auth\n@aserto.check(objType=\"resource\", objIdMapper=id_mapper, relationName=\"can_read\")\ndef get_resource(asset: str):\n    return {\"message\": \"Hello from GET /resource/\" + asset}\n\n```\n\nGetResource(asset) is an http handler function that serves GET request to the /resource/\u003casset\u003e route. The `check` call only authorizes requests if the calling user has the `can_read` permission on an object of type resource with the object name extracted from the route's {asset} parameter.\n\n### Check Options\nThe `check` function accepts options that configure the object, subject, and relation sent to the authorizer.\n\n```py\n    def check(\n        self,\n        objId: Optional[str] = \"\",\n        objType: Optional[str] = \"\",\n        objIdMapper: Optional[StringMapper] = None,\n        objMapper: Optional[ObjectMapper] = None,\n        relationName: Optional[str] = \"\",\n        relationMapper: Optional[StringMapper] = None,\n        subjType: Optional[str] = \"\",\n        subjMapper: Optional[IdentityMapper] = None,\n        policyPath: Optional[str] = \"\",\n        policyRoot: Optional[str] = \"\",\n        policyPathMapper: Optional[StringMapper] = None,\n```\n\n`subjType` can be used to override `subject_type` in the resource context. If an subject mapper isn't provided, the check call uses the default one which is `user`.\n\n`relationName` sets the relation name sent to the authorizer.\n\n`relationMapper` can be used in cases where the relation to be checked isn't known ahead of time. It receives a function that returns the name of the relation.\n\n`objType` sets the object type sent to the authorizer.\n\n`objId` sets the object ID sent to the authorizer.\n\n`objIdMapper` is used to determine the object ID sent to the authorizer at runtime. It receives a function that returns an object ID.\n\n`objMapper` can be used to set both the object type and ID at runtime. It receives a function that takes returns an `Obj`.\n\n```py\nclass Obj:\n    id: str\n    objType: str\n```\n\n`policyPath` sets the name of the policy module to evaluate in check calls. It defaults to `check`.\n\n`policyRoot` sets the root of the policy module. For example, if the root is set to \"myPolicy\", the Check call looks for a policy module named `myPolicy.check`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faserto-dev%2Fflask-aserto","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faserto-dev%2Fflask-aserto","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faserto-dev%2Fflask-aserto/lists"}